ERPNext bug bounty programs

ERPNext programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
ER ERPNext Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	10 days promised	Open

• ER

  ERPNext

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  10 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://erpnext.com

  Web

• Accounting and the general ledger, including journal entries, payment entries and the reconciliation flows

  Products and areas

• Manufacturing, bills of materials, work orders and the subcontracting flow

  Products and areas

• Projects, timesheets and assets, plus anything that bills a customer from recorded time

  Products and areas

• Server scripts, client scripts and custom workflow, where an administrator's configuration becomes executable behaviour

  Products and areas

• Stock, warehouses and the valuation logic that turns movements into financial postings

  Products and areas

• The customer and supplier portal, the authenticated but low-privilege surface where an external party views their own documents

  Products and areas

• The data import and export tooling, and file attachments on any document

  Products and areas

• The permission model as ERPNext configures it: role permissions, user permissions, document-level sharing and the checks applied when one user opens another's record

  Products and areas

• The point-of-sale interface and its offline queue, which holds transaction data on a client until it syncs

  Products and areas

• The policy points every report to [email protected] and states no component boundary, so the whole ERPNext application set is in scope, on both self-hosted and hosted deployments

  Products and areas

• The print and report layer, including custom print formats and query reports that turn user parameters into database work

  Products and areas

• The REST API over doctypes, which exposes create, read, update and delete on business records to any authenticated consumer

  Products and areas

• The selling and buying cycle end to end: quotations, sales and purchase orders, invoices, delivery notes and receipts

  Products and areas

No target matches. Try part of a host name, such as the company name.